Some merchants initiate payment transactions with consumers by using a mobile POS device belonging to the merchant, such as a smartphone or tablet computer (e.g., Apple iPad or the like). For example, a small, mobile card reader can be plugged into the audio jack of the mobile POS device and point-of-sale (POS) software can be executed by the mobile POS device to facilitate payment transactions completed using a payment card (e.g., credit card or debit card). The merchant swipes the consumer's payment card through the card reader, and the card reader communicates the card's data to the POS software in the mobile device. The POS software can then confirm the authenticity of the card and communicate with a remote payment authorization system to obtain authorization for the transaction.
This type of payment model, however, requires that a number of security-related issues be addressed. For example, data read from the payment card needs to be protected from discovery by unauthorized parties or entities, such as malicious software (“malware”) that may exist in the mobile device. Consequently, the payment card may require the consumer input a passcode as a security measure before data is read from the card by the card reader or decrypted by the POS software. Passcodes are required, for example, in debit card-based transactions and in some credit card-based transactions, such as those associated with the Europay, MasterCard, and Visa (EMV) standard. Consequently, a problem exists, particularly (though not exclusively) for devices that participate in electronic payment transactions, of how to protect passcodes from discovery by unauthorized parties or entities.